Changelog
### 1.26.11
```
====================
* Fixed an issue where reading more than 2 GiB in a call to ``HTTPResponse.read`` would
raise an ``OverflowError`` on Python 3.9 and earlier.
```
### 1.26.10
```
====================
* Removed support for Python 3.5
* Fixed an issue where a ``ProxyError`` recommending configuring the proxy as HTTP
instead of HTTPS could appear even when an HTTPS proxy wasn't configured.
```
### 1.26.9
```
===================
* Changed ``urllib3[brotli]`` extra to favor installing Brotli libraries that are still
receiving updates like ``brotli`` and ``brotlicffi`` instead of ``brotlipy``.
This change does not impact behavior of urllib3, only which dependencies are installed.
* Fixed a socket leaking when ``HTTPSConnection.connect()`` raises an exception.
* Fixed ``server_hostname`` being forwarded from ``PoolManager`` to ``HTTPConnectionPool``
when requesting an HTTP URL. Should only be forwarded when requesting an HTTPS URL.
```
### 1.26.8
```
===================
* Added extra message to ``urllib3.exceptions.ProxyError`` when urllib3 detects that
a proxy is configured to use HTTPS but the proxy itself appears to only use HTTP.
* Added a mention of the size of the connection pool when discarding a connection due to the pool being full.
* Added explicit support for Python 3.11.
* Deprecated the ``Retry.MAX_BACKOFF`` class property in favor of ``Retry.DEFAULT_MAX_BACKOFF``
to better match the rest of the default parameter names. ``Retry.MAX_BACKOFF`` is removed in v2.0.
* Changed location of the vendored ``ssl.match_hostname`` function from ``urllib3.packages.ssl_match_hostname``
to ``urllib3.util.ssl_match_hostname`` to ensure Python 3.10+ compatibility after being repackaged
by downstream distributors.
* Fixed absolute imports, all imports are now relative.
```
### 1.26.7
```
===================
* Fixed a bug with HTTPS hostname verification involving IP addresses and lack
of SNI. (Issue 2400)
* Fixed a bug where IPv6 braces weren't stripped during certificate hostname
matching. (Issue 2240)
```
### 1.26.6
```
===================
* Deprecated the ``urllib3.contrib.ntlmpool`` module. urllib3 is not able to support
it properly due to `reasons listed in this issue <https://github.com/urllib3/urllib3/issues/2282>`_.
If you are a user of this module please leave a comment.
* Changed ``HTTPConnection.request_chunked()`` to not erroneously emit multiple
``Transfer-Encoding`` headers in the case that one is already specified.
* Fixed typo in deprecation message to recommend ``Retry.DEFAULT_ALLOWED_METHODS``.
```
### 1.26.5
```
===================
* Fixed deprecation warnings emitted in Python 3.10.
* Updated vendored ``six`` library to 1.16.0.
* Improved performance of URL parser when splitting
the authority component.
```
### 1.26.4
```
===================
* Changed behavior of the default ``SSLContext`` when connecting to HTTPS proxy
during HTTPS requests. The default ``SSLContext`` now sets ``check_hostname=True``.
```
### 1.26.3
```
===================
* Fixed bytes and string comparison issue with headers (Pull 2141)
* Changed ``ProxySchemeUnknown`` error message to be
more actionable if the user supplies a proxy URL without
a scheme. (Pull 2107)
```
### 1.26.2
```
===================
* Fixed an issue where ``wrap_socket`` and ``CERT_REQUIRED`` wouldn't
be imported properly on Python 2.7.8 and earlier (Pull 2052)
```
### 1.26.1
```
===================
* Fixed an issue where two ``User-Agent`` headers would be sent if a
``User-Agent`` header key is passed as ``bytes`` (Pull 2047)
```
### 1.26.0
```
===================
* **NOTE: urllib3 v2.0 will drop support for Python 2**.
`Read more in the v2.0 Roadmap <https://urllib3.readthedocs.io/en/latest/v2-roadmap.html>`_.
* Added support for HTTPS proxies contacting HTTPS servers (Pull 1923, Pull 1806)
* Deprecated negotiating TLSv1 and TLSv1.1 by default. Users that
still wish to use TLS earlier than 1.2 without a deprecation warning
should opt-in explicitly by setting ``ssl_version=ssl.PROTOCOL_TLSv1_1`` (Pull 2002)
**Starting in urllib3 v2.0: Connections that receive a ``DeprecationWarning`` will fail**
* Deprecated ``Retry`` options ``Retry.DEFAULT_METHOD_WHITELIST``, ``Retry.DEFAULT_REDIRECT_HEADERS_BLACKLIST``
and ``Retry(method_whitelist=...)`` in favor of ``Retry.DEFAULT_ALLOWED_METHODS``,
``Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT``, and ``Retry(allowed_methods=...)``
(Pull 2000) **Starting in urllib3 v2.0: Deprecated options will be removed**
* Added default ``User-Agent`` header to every request (Pull 1750)
* Added ``urllib3.util.SKIP_HEADER`` for skipping ``User-Agent``, ``Accept-Encoding``,
and ``Host`` headers from being automatically emitted with requests (Pull 2018)
* Collapse ``transfer-encoding: chunked`` request data and framing into
the same ``socket.send()`` call (Pull 1906)
* Send ``http/1.1`` ALPN identifier with every TLS handshake by default (Pull 1894)
* Properly terminate SecureTransport connections when CA verification fails (Pull 1977)
* Don't emit an ``SNIMissingWarning`` when passing ``server_hostname=None``
to SecureTransport (Pull 1903)
* Disabled requesting TLSv1.2 session tickets as they weren't being used by urllib3 (Pull 1970)
* Suppress ``BrokenPipeError`` when writing request body after the server
has closed the socket (Pull 1524)
* Wrap ``ssl.SSLError`` that can be raised from reading a socket (e.g. "bad MAC")
into an ``urllib3.exceptions.SSLError`` (Pull 1939)
```
### 1.25.11
```
====================
* Fix retry backoff time parsed from ``Retry-After`` header when given
in the HTTP date format. The HTTP date was parsed as the local timezone
rather than accounting for the timezone in the HTTP date (typically
UTC) (Pull 1932, Pull 1935, Pull 1938, Pull 1949)
* Fix issue where an error would be raised when the ``SSLKEYLOGFILE``
environment variable was set to the empty string. Now ``SSLContext.keylog_file``
is not set in this situation (Pull 2016)
```
### 1.25.10
```
====================
* Added support for ``SSLKEYLOGFILE`` environment variable for
logging TLS session keys with use with programs like
Wireshark for decrypting captured web traffic (Pull 1867)
* Fixed loading of SecureTransport libraries on macOS Big Sur
due to the new dynamic linker cache (Pull 1905)
* Collapse chunked request bodies data and framing into one
call to ``send()`` to reduce the number of TCP packets by 2-4x (Pull 1906)
* Don't insert ``None`` into ``ConnectionPool`` if the pool
was empty when requesting a connection (Pull 1866)
* Avoid ``hasattr`` call in ``BrotliDecoder.decompress()`` (Pull 1858)
```
### 1.25.9
```
===================
* Added ``InvalidProxyConfigurationWarning`` which is raised when
erroneously specifying an HTTPS proxy URL. urllib3 doesn't currently
support connecting to HTTPS proxies but will soon be able to
and we would like users to migrate properly without much breakage.
See `this GitHub issue <https://github.com/urllib3/urllib3/issues/1850>`_
for more information on how to fix your proxy config. (Pull 1851)
* Drain connection after ``PoolManager`` redirect (Pull 1817)
* Ensure ``load_verify_locations`` raises ``SSLError`` for all backends (Pull 1812)
* Rename ``VerifiedHTTPSConnection`` to ``HTTPSConnection`` (Pull 1805)
* Allow the CA certificate data to be passed as a string (Pull 1804)
* Raise ``ValueError`` if method contains control characters (Pull 1800)
* Add ``__repr__`` to ``Timeout`` (Pull 1795)
```
### 1.25.8
```
===================
* Drop support for EOL Python 3.4 (Pull 1774)
* Optimize _encode_invalid_chars (Pull 1787)
```
### 1.25.7
```
===================
* Preserve ``chunked`` parameter on retries (Pull 1715, Pull 1734)
* Allow unset ``SERVER_SOFTWARE`` in App Engine (Pull 1704, Issue 1470)
* Fix issue where URL fragment was sent within the request target. (Pull 1732)
* Fix issue where an empty query section in a URL would fail to parse. (Pull 1732)
* Remove TLS 1.3 support in SecureTransport due to Apple removing support (Pull 1703)
```
### 1.25.6
```
===================
* Fix issue where tilde (``~``) characters were incorrectly
percent-encoded in the path. (Pull 1692)
```
### 1.25.5
```
===================
* Add mitigation for BPO-37428 affecting Python <3.7.4 and OpenSSL 1.1.1+ which
caused certificate verification to be enabled when using ``cert_reqs=CERT_NONE``.
(Issue 1682)
```
### 1.25.4
```
===================
* Propagate Retry-After header settings to subsequent retries. (Pull 1607)
* Fix edge case where Retry-After header was still respected even when
explicitly opted out of. (Pull 1607)
* Remove dependency on ``rfc3986`` for URL parsing.
* Fix issue where URLs containing invalid characters within ``Url.auth`` would
raise an exception instead of percent-encoding those characters.
* Add support for ``HTTPResponse.auto_close = False`` which makes HTTP responses
work well with BufferedReaders and other ``io`` module features. (Pull 1652)
* Percent-encode invalid characters in URL for ``HTTPConnectionPool.request()`` (Pull 1673)
```
Links
- PyPI: https://pypi.org/project/urllib3
- Changelog: https://pyup.io/changelogs/urllib3/
- Docs: https://urllib3.readthedocs.io/
pyup-bot
commented
1 year ago
This PR updates urllib3 from 1.25.3 to 1.26.12.
Changelog
### 1.26.11 ``` ==================== * Fixed an issue where reading more than 2 GiB in a call to ``HTTPResponse.read`` would raise an ``OverflowError`` on Python 3.9 and earlier. ``` ### 1.26.10 ``` ==================== * Removed support for Python 3.5 * Fixed an issue where a ``ProxyError`` recommending configuring the proxy as HTTP instead of HTTPS could appear even when an HTTPS proxy wasn't configured. ``` ### 1.26.9 ``` =================== * Changed ``urllib3[brotli]`` extra to favor installing Brotli libraries that are still receiving updates like ``brotli`` and ``brotlicffi`` instead of ``brotlipy``. This change does not impact behavior of urllib3, only which dependencies are installed. * Fixed a socket leaking when ``HTTPSConnection.connect()`` raises an exception. * Fixed ``server_hostname`` being forwarded from ``PoolManager`` to ``HTTPConnectionPool`` when requesting an HTTP URL. Should only be forwarded when requesting an HTTPS URL. ``` ### 1.26.8 ``` =================== * Added extra message to ``urllib3.exceptions.ProxyError`` when urllib3 detects that a proxy is configured to use HTTPS but the proxy itself appears to only use HTTP. * Added a mention of the size of the connection pool when discarding a connection due to the pool being full. * Added explicit support for Python 3.11. * Deprecated the ``Retry.MAX_BACKOFF`` class property in favor of ``Retry.DEFAULT_MAX_BACKOFF`` to better match the rest of the default parameter names. ``Retry.MAX_BACKOFF`` is removed in v2.0. * Changed location of the vendored ``ssl.match_hostname`` function from ``urllib3.packages.ssl_match_hostname`` to ``urllib3.util.ssl_match_hostname`` to ensure Python 3.10+ compatibility after being repackaged by downstream distributors. * Fixed absolute imports, all imports are now relative. ``` ### 1.26.7 ``` =================== * Fixed a bug with HTTPS hostname verification involving IP addresses and lack of SNI. (Issue 2400) * Fixed a bug where IPv6 braces weren't stripped during certificate hostname matching. (Issue 2240) ``` ### 1.26.6 ``` =================== * Deprecated the ``urllib3.contrib.ntlmpool`` module. urllib3 is not able to support it properly due to `reasons listed in this issue <https://github.com/urllib3/urllib3/issues/2282>`_. If you are a user of this module please leave a comment. * Changed ``HTTPConnection.request_chunked()`` to not erroneously emit multiple ``Transfer-Encoding`` headers in the case that one is already specified. * Fixed typo in deprecation message to recommend ``Retry.DEFAULT_ALLOWED_METHODS``. ``` ### 1.26.5 ``` =================== * Fixed deprecation warnings emitted in Python 3.10. * Updated vendored ``six`` library to 1.16.0. * Improved performance of URL parser when splitting the authority component. ``` ### 1.26.4 ``` =================== * Changed behavior of the default ``SSLContext`` when connecting to HTTPS proxy during HTTPS requests. The default ``SSLContext`` now sets ``check_hostname=True``. ``` ### 1.26.3 ``` =================== * Fixed bytes and string comparison issue with headers (Pull 2141) * Changed ``ProxySchemeUnknown`` error message to be more actionable if the user supplies a proxy URL without a scheme. (Pull 2107) ``` ### 1.26.2 ``` =================== * Fixed an issue where ``wrap_socket`` and ``CERT_REQUIRED`` wouldn't be imported properly on Python 2.7.8 and earlier (Pull 2052) ``` ### 1.26.1 ``` =================== * Fixed an issue where two ``User-Agent`` headers would be sent if a ``User-Agent`` header key is passed as ``bytes`` (Pull 2047) ``` ### 1.26.0 ``` =================== * **NOTE: urllib3 v2.0 will drop support for Python 2**. `Read more in the v2.0 Roadmap <https://urllib3.readthedocs.io/en/latest/v2-roadmap.html>`_. * Added support for HTTPS proxies contacting HTTPS servers (Pull 1923, Pull 1806) * Deprecated negotiating TLSv1 and TLSv1.1 by default. Users that still wish to use TLS earlier than 1.2 without a deprecation warning should opt-in explicitly by setting ``ssl_version=ssl.PROTOCOL_TLSv1_1`` (Pull 2002) **Starting in urllib3 v2.0: Connections that receive a ``DeprecationWarning`` will fail** * Deprecated ``Retry`` options ``Retry.DEFAULT_METHOD_WHITELIST``, ``Retry.DEFAULT_REDIRECT_HEADERS_BLACKLIST`` and ``Retry(method_whitelist=...)`` in favor of ``Retry.DEFAULT_ALLOWED_METHODS``, ``Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT``, and ``Retry(allowed_methods=...)`` (Pull 2000) **Starting in urllib3 v2.0: Deprecated options will be removed** * Added default ``User-Agent`` header to every request (Pull 1750) * Added ``urllib3.util.SKIP_HEADER`` for skipping ``User-Agent``, ``Accept-Encoding``, and ``Host`` headers from being automatically emitted with requests (Pull 2018) * Collapse ``transfer-encoding: chunked`` request data and framing into the same ``socket.send()`` call (Pull 1906) * Send ``http/1.1`` ALPN identifier with every TLS handshake by default (Pull 1894) * Properly terminate SecureTransport connections when CA verification fails (Pull 1977) * Don't emit an ``SNIMissingWarning`` when passing ``server_hostname=None`` to SecureTransport (Pull 1903) * Disabled requesting TLSv1.2 session tickets as they weren't being used by urllib3 (Pull 1970) * Suppress ``BrokenPipeError`` when writing request body after the server has closed the socket (Pull 1524) * Wrap ``ssl.SSLError`` that can be raised from reading a socket (e.g. "bad MAC") into an ``urllib3.exceptions.SSLError`` (Pull 1939) ``` ### 1.25.11 ``` ==================== * Fix retry backoff time parsed from ``Retry-After`` header when given in the HTTP date format. The HTTP date was parsed as the local timezone rather than accounting for the timezone in the HTTP date (typically UTC) (Pull 1932, Pull 1935, Pull 1938, Pull 1949) * Fix issue where an error would be raised when the ``SSLKEYLOGFILE`` environment variable was set to the empty string. Now ``SSLContext.keylog_file`` is not set in this situation (Pull 2016) ``` ### 1.25.10 ``` ==================== * Added support for ``SSLKEYLOGFILE`` environment variable for logging TLS session keys with use with programs like Wireshark for decrypting captured web traffic (Pull 1867) * Fixed loading of SecureTransport libraries on macOS Big Sur due to the new dynamic linker cache (Pull 1905) * Collapse chunked request bodies data and framing into one call to ``send()`` to reduce the number of TCP packets by 2-4x (Pull 1906) * Don't insert ``None`` into ``ConnectionPool`` if the pool was empty when requesting a connection (Pull 1866) * Avoid ``hasattr`` call in ``BrotliDecoder.decompress()`` (Pull 1858) ``` ### 1.25.9 ``` =================== * Added ``InvalidProxyConfigurationWarning`` which is raised when erroneously specifying an HTTPS proxy URL. urllib3 doesn't currently support connecting to HTTPS proxies but will soon be able to and we would like users to migrate properly without much breakage. See `this GitHub issue <https://github.com/urllib3/urllib3/issues/1850>`_ for more information on how to fix your proxy config. (Pull 1851) * Drain connection after ``PoolManager`` redirect (Pull 1817) * Ensure ``load_verify_locations`` raises ``SSLError`` for all backends (Pull 1812) * Rename ``VerifiedHTTPSConnection`` to ``HTTPSConnection`` (Pull 1805) * Allow the CA certificate data to be passed as a string (Pull 1804) * Raise ``ValueError`` if method contains control characters (Pull 1800) * Add ``__repr__`` to ``Timeout`` (Pull 1795) ``` ### 1.25.8 ``` =================== * Drop support for EOL Python 3.4 (Pull 1774) * Optimize _encode_invalid_chars (Pull 1787) ``` ### 1.25.7 ``` =================== * Preserve ``chunked`` parameter on retries (Pull 1715, Pull 1734) * Allow unset ``SERVER_SOFTWARE`` in App Engine (Pull 1704, Issue 1470) * Fix issue where URL fragment was sent within the request target. (Pull 1732) * Fix issue where an empty query section in a URL would fail to parse. (Pull 1732) * Remove TLS 1.3 support in SecureTransport due to Apple removing support (Pull 1703) ``` ### 1.25.6 ``` =================== * Fix issue where tilde (``~``) characters were incorrectly percent-encoded in the path. (Pull 1692) ``` ### 1.25.5 ``` =================== * Add mitigation for BPO-37428 affecting Python <3.7.4 and OpenSSL 1.1.1+ which caused certificate verification to be enabled when using ``cert_reqs=CERT_NONE``. (Issue 1682) ``` ### 1.25.4 ``` =================== * Propagate Retry-After header settings to subsequent retries. (Pull 1607) * Fix edge case where Retry-After header was still respected even when explicitly opted out of. (Pull 1607) * Remove dependency on ``rfc3986`` for URL parsing. * Fix issue where URLs containing invalid characters within ``Url.auth`` would raise an exception instead of percent-encoding those characters. * Add support for ``HTTPResponse.auto_close = False`` which makes HTTP responses work well with BufferedReaders and other ``io`` module features. (Pull 1652) * Percent-encode invalid characters in URL for ``HTTPConnectionPool.request()`` (Pull 1673) ```Links
- PyPI: https://pypi.org/project/urllib3 - Changelog: https://pyup.io/changelogs/urllib3/ - Docs: https://urllib3.readthedocs.io/